CVE-2026-111652
Received Received - Intake

Unauthenticated File Download in Engineercms

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111652
EUVD
EUVD-2026-103074

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
3xxx engineercms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in EngineerCMS version 2.0.5. It allows unauthenticated attackers to download project image and video attachments by requesting specific file paths like /attachment/* for .jpg, .png, .bmp, or .mp4 files. The system serves these files without performing any access control checks, bypassing casbin, owner, or admin validation.

Detection Guidance

Check for unauthorized access to /attachment/* paths with .jpg, .png, .bmp, or .mp4 files. Use tools like curl to test if files are accessible without authentication. Example: curl http://<target>/attachment/PRJ001demo/A/site-survey.jpg. Monitor logs for suspicious requests to these endpoints.

Impact Analysis

Attackers can access sensitive project materials such as site photographs, scanned documents, and video walkthroughs belonging to other users. This includes unauthorized disclosure of proprietary or confidential engineering project data, even for users without authentication or proper permissions.

Mitigation Strategies

Upgrade EngineerCMS to a patched version beyond 2.0.5. Implement strict access controls for /attachment/* endpoints. Add authentication and authorization checks for image and video file requests. Review and sanitize user-supplied input in attachment controllers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart